Medium severity · published Sep 28, 2026
CVE-2026-102366
mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mall4j · gz-yami
through 4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102366
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102366
exploit
https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A03_admin_file_upload_xss.py
product
https://github.com/gz-yami/mall4j
technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/FileController.java#L44-L64
technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/java/com/yami/shop/service/impl/AttachFileServiceImpl.java#L62-L81
third-party-advisory
https://www.vulncheck.com/advisories/mall4j-through-4.0-unrestricted-file-upload-in-admin-file-endpoints
More from mall4j
9.1
CVE-2026-102361
mall4j through 4.0 Missing Authentication in Password Update Endpoint
6.5
CVE-2026-102365
mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
5.4
CVE-2026-108691
mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
5.4
CVE-2026-102367
mall4j through 4.0 Insufficient Session Expiration via Token Refresh
5.4
CVE-2026-102364
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API